An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.

Juju Joyent provider uploads user's private ssh key by default

Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.